Privacy: Corporate services

This privacy notice is designed to help you understand how we use personal information when delivering our corporate services, we have set out below the services types, the information we may use to deliver the services, who we may share it with, and how long we will keep it.

What services are covered by this privacy notice?

Accommodation and travel bookings

Provides travel and accommodation services to meet business needs.

Business Continuity

Provides emergency planning and resilience and business continuity services.

Corporate health and safety

Provides advice on health and safety management.

Democracy Team / Democratic Services

Provides support to council committees including Full Council and provides direct support to councillors through the group offices.

Electronic Disclosure and Barring (eDBS)

Provides DBS checks for employment and pre-employment contracts.

Essex Film Office

Offers a location database for film production professionals, to source locations for filming and to apply for permits to undertake filming activity in Essex.

Essex Pensions

Pension Administration Service provided by Essex Pension Fund to Essex County Council and Police Uniform and Firefighters schemes.

Finance Transactional services

Provides transactional services for the council, payments to suppliers, manages the income team and provides financial assessments for social care.

Leadership and Talent

The provision of personal, professional, management and leadership development and consultation support services.

Member Enquiries

Provides advice, support and prepare responses to requests for information for council members, Cabinet Members and Chief Executive Officer.

Organisational Development and People

Provides an HR and organisational development service for Essex County Council and its employees.

Partnerships

Events and communications management to transform how we work with different communities, groups and businesses to plan our future and tackle disadvantage.

Recruitment, Payroll, Contracts and Processing

Provides a service to Essex County Council and its employees for recruitment, payments and contracts.

Technology Services

Provide the organisation with the technology to complete their work and support them in its use. The Enterprise Service Management (ESM) system is used for incidents, requests, problems / known errors, changes and releases. This is a single point of contact for individuals. Information Governance use this system for incidents, requests and security incidents.

Vehicle Lease Car Provision Scheme

Provides vehicle lease management for council employees for the Car Provision scheme.

What personal information do we hold?

We only collect and use the minimum personal information required to deliver your service. Wherever possible we use non-identifiable personal information.

The services may use some or all of the personal information below:

• names, address and contact details
• family relationships and friendships
• lifestyle and social circumstances
• employment and education
• date of birth
• marital status
• occupation
• National Insurance number
• driving licence details
• gender
• disclosure of criminal convictions and offences (including alleged offences)
• criminal proceedings, outcomes and sentences
• referee and emergency contact information including, name and contact details, relationship to you, job title
• health information
• financial details
• pensions information
• beneficiaries information
• ethnicity and or nationality
• visual images, personal appearance and behaviour
• religious or other beliefs of a similar nature
• licences and permits held
• goods and services information
• business activities
• trade union membership
• political party membership and affiliations
• case file information
• confidential references

We get most of this information from you, but we may also get some of this information about you from health and education providers, commissioned partners, family members, your legal representative, referees, employers, regulatory bodies, police, other local authorities.

How do we use your personal information?

We use your information for one or more of the following reasons:

• to deliver the service, or handle your query
• to manage and support you as an employee/volunteer
• to enable us to contact someone for you in case of an emergency
• to plan and improve the service we offer
• to detect and prevent crime or fraud
• for research, however this would be in anonymised form unless we ask for your consent to use your personal information for this purpose
• to evidence employment to secure funding grants

Who else might we share your personal information with?

Sometimes we may need to share your information, but we will only do so where it is necessary or required by law.

We will only share the minimum information for each circumstance. We may sometimes need to share some of your personal information with one or more of the following:

• central government departments (for example, the Health and Safety Executive, HMRC, DWP, Home Office and DVLA)
• regulatory bodies (for example, HCPC and GIC)
• trade unions
• pension service providers
• police (only for the purposes of preventing or detecting crime or fraud)
• Essex Fire and Rescue (emergency planning)
• other local authorities
• health agencies / providers
• prospective employers
• commissioned partners (who deliver services on our behalf)
• your legal representatives (for example, a solicitor / advocate)
• Cornerstone OnDemand Limited
• debt collection agencies
• debt enforcement agents
• Innovate Healthcare as our Occupation Health Service provider
• DocuSign as Data Processors providing the system we need in order to offer digital signatures for documents.

We may also use Data Processors to support these activities, for example by providing the systems we need or delivering services on our behalf. These include:

• Astech supports Democratic Services
• Axios Assyst support the ESM system
• Business Safety Systems supports our health and safety service
• CapitaPay 360 for taking payments and issuing SMS receipts. For SMS receipts, this information will be retained in GOV.UK Notify for 7 days then deleted. This information will not be used for any other purpose.
• Civica, Citibank, HH Global, Tracesmart and Faraday, Charities Trust (registered charity), Child Support Agency, CAPS, Fines, BHSF, Simply Health, Essex Police Sports Association, Essex Police Sports Association Lottery and Lloyds (sponsoring bank) support Essex Pension Fund
• GDS/Gov.uk Notify, Shadow-Planner and ResilienceDirect support our Business Continuity services
• Launchpad Recruits is used to screen candidates during the recruitment process
• Mosaic and Confirm provide case management support for Member Enquiries
• Oracle, Fujitsu and Evosys support our HR, payroll and financial transaction services.
• Redfern support our partnership travel and accommodation bookings.
• Mandiant and SecurityHQ supports the Council by providing continuous monitoring of our technical estate and enhanced alerting of potential security risks, as well as Incident response and expertise to enable us to protect our network from cyber security risks.
• Talent Clouds supports our eDBS service
• TCS Learn, Robertson Cooper, CPP (trading as OPP) and Saville Assessment Ltd support our Leadership and Talent service
• TCS, Mosaic and Marketplace support our purchase to pay service
• TMP Worldwide UK supports the council by conducting research, using Talent Advisory Specialist to assist with recruitment
• XMA supports sending IT peripherals equipment to staff members' homes

Who is the data controller for this processing?

Essex County Council is the Data Controller for this processing with the exception of Essex Pensions Service, where ECC is a Joint Data Controller with:

• Barnett Waddingham (scheme actuary)
• Equitable Life (scheme AVC provider)
• Ernst Young (scheme auditor)
• Essex Pension Fund (pension administrators)
• HM Revenue and Customs
• Prudential (scheme AVC provider)
• South Yorkshire Pension Authority (LGPS National Insurance Database)
• Standard Life (scheme AVC provider)
• The Cabinet Office (National Fraud Initiative)
• The Courts of England and Wales (Pension Sharing)
• The Department for Work and Pensions
• The Governments Actuary’s Department

We may use your information for the prevention and detection of fraud and crime, this may include sharing your personal information with external agencies that could lead to some services being declined. Read more about how your information is processed.

What is the legal basis for our use of your personal information?

View the tables which show the legal basis we rely on to use your personal or special category (sensitive) personal information.

View a list of the full legal conditions we may rely on by looking at our full privacy notice.

View a list of the legislation we rely on when using your personal information to meet our legal obligations or public tasks.

Where we rely on your consent to use your personal information you have the right to withdraw this consent at any time by contacting our Data Protection Officer, and advising which service you are using.

Will my personal information be accessible outside the UK?

The Essex Pension Fund does have a number of overseas members who reside in countries other than the UK. The majority of these are in European Countries, USA or Australia. The fund does not transfer data relating to overseas members to anyone other than the member and appropriate safeguards are applied.

When booking for accommodation or flights via our supplier Redfern the data will be accessible to their parent company in the United States. In order to safeguard your personal information and ensure you have the same rights as you would if your personal information was processed in the UK we have ensured that the parent company is registered with the US Privacy Shield, meaning the EU has agreed that they have an adequate level of data protection in place.

No other personal information is routinely sent or held outside the UK. Should the transfer of personal information outside of the UK become necessary, it will only take place if permitted by law, and then only where there are appropriate safeguards in place to protect the data.

The forthcoming HR Recruitment and Learning system (which is due to be released at the end of 2019) may need to send data to the US (classified as having “adequate” data security) and India (a contract is held guaranteeing security of the data).

In those cases the data will be used for one of the following reasons:

• production troubleshooting
• researching data flow for client data
• bug fixes
• implementation of patches
• client data change requests

How long will we keep your personal information?

We will only use your personal information whilst delivering the service to you and to deal with any questions or complaints that we may receive about this, unless the law requires us to keep it for a longer period. In practice, this means that your personal information may be retained for different periods of time, depending on the relevant service.

Business Continuity

We will stop using your personal information after one year. Records relating to a major event may be held indefinitely for historical public archiving purposes, otherwise the data will be deleted immediately after we stop using it.

Corporate Health and Safety

We will stop using your personal information after your case concludes and delete it after 5 years.

Elected Members

Your personal information will be maintained indefinitely and become part of the permanent and historical public records of Essex County Council that may be accessed by the public through the Essex Record Office.

Electronic Disclosure and Barring

We will stop using your personal information when your employment ends and delete it after 25 years.

Essex Pensions

We will stop using your data after you (or any beneficiary who receives benefits after your death) cease to be entitled to benefits from the Fund. Your data will be deleted 15 years or once the administrator deems that the data is no longer needed for the purpose of exercising or defending a legal claim.

Leadership and Talent

We will stop using your personal information when your employment ends and will delete it after 7 years.

Member Enquiries

We will stop using your personal information when your query is resolved and delete it after 2 years.

Organisational Development and People

We will stop using your personal information when your employment ends and will delete it after 7 years, or where an eDBS is required, after 25 years.

Partnerships

We will stop using your personal information once an event has concluded or you have advised you no longer wish to remain on our mailing list and it will be deleted immediately.

Purchase to Pay

We will stop using your personal information when the service you receive ends, and delete it after 7 years.

Recruitment, Payroll, Contracts and Processing

We will stop using your personal information when your employment ends and will delete it after 7 years.

Technology Services

We will stop using your personal information when the ticket you raised is complete, and delete it after 2 years.

Vehicle Lease Management

We will stop using your personal information when the lease / hire car has been returned and it will be deleted after 7 years for lease vehicles and one year for hire vehicles.

Your rights

The law gives you a number of rights to control what personal information is used by us and how it is used by us.

You can obtain further information about these rights from the Information Commissioner’s Office.

You also have the right to lodge a complaint in relation to this summary notice, the full privacy notice or our processing activities with the Information Commissioner’s Office.

Contact us

If you wish to exercise any of these rights, you can contact our Data Protection Officer.